Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I manage a domain with the "Active Directory Users and Computers" from a computer that is not on that domain? I realize I'll need some domain admin (or less) credentials, but that's fine.

I have 2 scenarios where I'd like to do this:

  1. From a machine on Domain 1 but I'd also like to manage Domain 2 (the 2 domains are in no way related)
  2. From a laptop that is not a member of any domain.

If we can figure out #2, that will be "good enough" but #1 would be nice too.

share|improve this question
add comment

2 Answers

up vote 7 down vote accepted

The "poor man's domain trust relationship" seems to do it for me.

I'm having no problems using "Active Directory Users and Computers" to administer accounts in a domain untrusted by my laptop computer (which is, itself, not a member of any domain) by creating a local account with a username and password that matches a user that's a member of "Domain Admins" in the domain to be managed. I'm launching ADU&C with "Run As" and supplying the alternative credential.

That same method ought to work fine for your first scenario, as well. Try it and see.

(My laptop client is running Windows XP Professional SP3 and the test domain controller is running Windows Server 2003 Standard x86 R2 SP2).

share|improve this answer
1  
I've heard of this referred to as "pass-through authentication". I've used it for similar purposes. –  Holocryptic May 13 '10 at 16:50
1  
I don't know what the "official" name for the functionality is, but I'm certainly glad that Microsoft bothered to continue "supporting" it in new versions of Windows. –  Evan Anderson May 13 '10 at 16:54
1  
+1 Works well for me as well. –  Dave M May 13 '10 at 17:08
    
This works well for me. A bit inconvenient, but I'll get over it. ;-) Note that in Win7, you must hold [SHIFT] while you right-click to get "Run As Different User" instead of just getting "Run As Admin". –  Jaxidian May 13 '10 at 17:20
add comment

It has been a while since I've had to do this, but I've had good luck mapping a drive to one of the DC's in my target domain using a Domain Admin user. Then launching ADU&C and attaching to the target domain. It inherits my domain credentials. Otherwise, Evan's method would be the 'seamless' method.

share|improve this answer
    
I'm not getting that to work w/ my test client and domain controller. I tried mapping drives to \\domain.com\sysvol and \\domain-controller.domain.com\c$ simultaneously (and individually) but I was still getting authentication errors when I actually tried to "Connect to Domain..." or "Connect to Domain Controller..." in ADU&C. –  Evan Anderson May 13 '10 at 17:40
    
As I said, it has been a while since I tried it, and when I tried it I was using XP. And I'm not currently equipped to test it right now. So! Experimentation rules the day, and it would not surprise me in the least to learn that Vista/W7 don't allow that method to work. –  sysadmin1138 May 13 '10 at 18:01
    
I bet it depends on how you connect to the domain controller. If you just connect by domain name (whatever magic that performs), then it would not work. However, if you connected to that specific domain controller (by specifying the hostname you used when mapping files), then I bet it would work. –  Jaxidian May 13 '10 at 18:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.